[Dell Venue] social-design-concepts:
just sharing information still no root access....

just sharing information still no root access....

jayjr1105 allowed me access to his V8 the only known rooted V8 w/ JB4.3 to dump the contents of /dev/block/mmcblk0p1 (block location of boot, droidboot, recovery) & mmcblk0p8 (android system)

using the same tools and process i used to extracted the kernels/ramdisk for the V8 4.2.2 dumps ive done the same for the 4.3 dumps.

interesting enough there are a total of 6 kernel/ramdisk in the 4.3 dump compared to the 3 found in the 4.2.2 dumps

i've have only been able to extract the contents of 4 of the 6 ramdisk some interesting things i've noticed so far.

3 of the 6 kernels are the new 3.4.43 kernel, 2 kernels are the old 3.4.34 kernel and 1 kernel is this 3.4.43 built 11 days earlier than the new 3.4.43 kernel puzzling ?

0x001f55e0 boot kernel version: 3.4.43 (DYY@build150) #1 SMP PREEMPT Sat Dec 21 13:41:59 CST 20

0x00cb35e0 droidboot kernel version: 3.4.34 (DYY@build162) #1 SMP PREEMPT Sat Oct 19 10:51:31 CST 20 can't extract ramdisk contents yet

0x011955e0 recovery kernel version: 3.4.43-00001-ga420d43 (DYY@build150) #1 SMP PREEMPT Tue Dec 10

0x02ced5e0 unknown kernel version: 3.4.34 (DYY@build162) #1 SMP PREEMPT Sat Oct 19 10:51:31 CST 20 can't extract ramdisk contents yet

0x030d55e0 recovery kernel version: 3.4.43 (DYY@build150) #1 SMP PREEMPT Sat Dec 21 13:41:59 CST 20

0x040755e0 droidboot kernel version: 3.4.43 (DYY@build150) #1 SMP PREEMPT Sat Dec 21 13:41:59 CST 20

i'll upload the dumps over the weekend if i get a chance....

still need to figure out how to extract the images from mmcblk0p1 as a whole image not just the kernel and ramdisk. needs more research maybe dd if=mmcblk0p1 and specify the starting and stopping addresses.

!!!!!!!!!!! most of this is dangerous risky and just plain stupid i'm just sharing information i recommend no one try any of this unless you know what you are doing !!!!!!!!!!!

i also copied /proc/iomem and /proc/kallsyms as root. to have generic address for hard coding exploits if need.

re-testing exploits with hard coded address - might of failed because my device is a V7 and the address are from a V8

hard coding the address in to https://github.com/android-rooting-tools all exploits fail though:

pref_event_exploit after running for awhile, a long long long while, will eventually crash something and force the device or maybe just adb to reboot.

not sure how to debug what's going on after an hour i just let it over night and when i checked my pc in the morning the command promp dropped out of adb shell????

!!!!!!!!!!! most of this is dangerous risky and just plain stupid i'm just sharing information i recommend no one try any of this unless you know what you are doing !!!!!!!!!!!

droidboot notes:

droidboot does not check for signatures when flashing the follow through fastboot flash <partition> <ext4.img file>

i have successfully been able to flash an ext4 image i made myself containing a simple test.txt inside, to all these and verified that they flashed

/dev/block/mmcblk0p3	/factory

/dev/block/mmcblk0p5	/config

/dev/block/mmcblk0p7	/logs

i have successfully been able to flash an ext4 image i made myself containing recovery/command file set to --wipe_data and reboot to recovery and have it execute

/dev/block/mmcblk0p6	/cache

i have successfully flashed small data.img files but having issues flashing anything larger than 100MB needs more researching maybe possible to flash a built userdata.img

/dev/block/mmcblk0p9	/data

flashing the /dev/block/mmcblk0p8	/system with the prerooted dump after mounting it as a loop device then repacking it with androids make_ext4fs tool might be possible but i'm not trying until i've figured out flashing data successfully

Confirmed The Venue 7/8 and the HP 1800la are signed with the same platform-keys both update.zip and images, successfully able to flash the images from the HP update.zip to the recovery partition through fastboot,

i knew this more than likely wouldn't boot, when rebooting into recovery, forces device into download mode. (used for factory flashing needs a lot of files we don't have any)

but no worries when android JB4.3 boots it checks the sha1 of recovery and if it is different than whats specified uses recovery-from-boot to build recovery from the boot partition and writes it to recovery partition.

you might ask why i would even try this what could be gained from this:

the hp implementation of droidboot has a big hole for granting root access:

fastboot oem adbdebug stops droidboot and restarts the adb service,

the flaw is the adb shell drops to a root shell under this mode allowing you to mount the system partition to a tmp directory for rooting.

Venue 7/8 version of droidboot doesn't drop to a root shell

droidboot from 4.2.2 fastboot oem adbdebug drops to a user shell ( confirmed by jcase before I even bought the Venue 7 )

droidboot from 4.3 fastboot oem adbdebug not accessable ro.adb.secure is set this needs more researching ro.adb.secure is set in recovery as well

research recovery: failed to mount /misc issue (maybe figuring this out and dropping the pub key for the host computer here will allow adb under these modes.

!!!!!!!!!!! most of this is dangerous risky and just plain stupid i'm just sharing information i recommend no one try any of this unless you know what you are doing !!!!!!!!!!!

just sharing information still no root access....

these are all safe to run under droidboot if you want a real out of box experience as fastboot -w and factory reset only wipes /data & /cache and not factory, config, or logs, first boot rebuilds all there contents.

fastboot oem erase /config

fastboot oem erase /factory

fastboot oem erase /cache

fastboot oem erase /data

fastboot oem erase /logs

when your finished you need to issue fastboot oem startftm then adb shell rm /logs/* (just like in recovery this is a temp log location and the device writes its contents back to the /dev/block/mmcblk0p7	/logs on reboot or shutdown)

then issue adb reboot to reboot into android.